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Abstract—Accident statistics cite the flight crew as a causal 
factor in over 60% of large transport aircraft fatal accidents. 
Yet, a well-trained and well-qualified pilot is acknowledged as 
the critical center point of aircraft systems safety and an integral 
safety component of the entire commercial aviation system. The 
latter statement, while generally accepted, cannot be verified 
because little or no quantitative data exists on how and how 
many accidents/incidents are averted by crew actions. A joint 
NASA/FAA high-fidelity motion-base simulation experiment 
specifically addressed this void by collecting data to quantify the 
human (pilot) contribution to safety-of-flight and the methods 
they use in today’s National Airspace System. A human-in-the- 
loop test was conducted using the FAA’s Oklahoma City Flight 
Simulation Branch Level D-certified B-737-800 simulator to 
evaluate the pilot’s contribution to safety-of-flight during routine 
air carrier flight operations and in response to aircraft system 
failures. These data are fundamental to and critical for the 
design and development of future increasingly autonomous 
systems that can better support the human in the cockpit. 
Eighteen U.S. airline crews flew various normal and non-normal 
procedures over a two-day period and their actions were 
recorded in response to failures. To quantify the human’s 
contribution to safety of flight, crew complement was used as the 
experiment independent variable in a between-subjects design. 
Pilot actions and performance during single pilot and reduced 
crew operations were measured for comparison against the 
normal two-crew complement during normal and non-normal 
situations. This paper details the crew’s actions, including 
decision-making, and responses while dealing with a drive shaft 
failure — one of 6 non-normal events that were simulated in this 
experiment. 


Keywords—flight crew error, aviation safety, increasingly 
autonomous systems, automation, automation surprise, crew 
complement, reduced crew operations, single pilot operations, drive 
shaft failure 
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I INTRODUCTION 


Accident statistics cite the flight crew as a causal factor in 
over 60% of large transport aircraft fatal accidents [1]. Yet, the 
Air Line Pilots Association says that “a well-trained and well- 
qualified pilot is acknowledged as the critical center point of 
aircraft systems safety and an integral safety component of the 
entire commercial aviation system” [2]. The latter statement, 
while generally accepted, cannot be verified because little or no 
quantitative data exists on how and how’ many 
accidents/incidents are averted by crew actions. Anecdotal 
evidence suggests crews handle routine failures on a daily basis 
and Aviation Safety Action Program (ASAP) data [3, 4] 
supports this assertion but its data are not publicly releasable. 
Without hard data, the contribution and methods employed by 
pilots to improve the safety of flight is difficult to define. 
Developing ways to augment and/or improve a pilot’s ability to 
contribute to flight safety is similarly ill-defined and is hard to 
characterize in the absence of quantifiable data. 


A joint NASA/FAA high-fidelity motion-base simulation 
experiment specifically addressed this void by collecting data 
to quantify the human (pilot) contribution to safety-of-flight 
and the methods used by pilots in today’s National Air-space 
System as they handled normal and non-normal conditions 
during typical revenue-like flight operations. The off-nominal 
conditions represented aircraft system failures that can and 
have occurred during revenue flight operations. These data are 
fundamental to and critical for the design and development of 
future increasingly autonomous systems that can better support 
the human in the cockpit. Different crew complement 
configurations were tested to gain understanding of the safety 
afforded by having two crew-members on the flight deck. 


This paper details the results and analysis of one of six non- 
normal events tested — a generator drive shaft failure. 


Il. METHODOLOGY 


Crew complement (single pilot and crewed configurations) 
was experimentally manipulated during normal and 
increasingly challenging non-normal airline operations to 
quantify the pilot contribution to flight safety. 


A. Experiment Design 
The test objectives of the experiment were as follows: 


¢ Establish “baseline” levels of performance and safety 
with nominal two-crew configuration as well as collect 
data to assess the performance and safety decrements in 
reduced crew and single pilot crew complements for 
present-day flight deck design and certification; and, 


¢ Identify technology requirements from these data for 
increasingly autonomous systems that might assist 
future two-crew operations and eventually, enable 
reduced crew or ultimately, single pilot operations. 


To assess human performance and safety, the experiment 
contrasted two-crew operations to conditions when one of the 
pilots was absent from the flight deck. The three crew 
complement configurations were: Two-Crew, Reduced Crew 
Operations (RCO), and Single Pilot Operations (SPO). If the 
condition included a temporary absence, it was designated as 
RCO. If the condition included a permanent absence, it was 
designated as SPO. 


The independent variables were crew complement and 
scenario. Each crew flew two normal scenarios and six non- 
normal scenarios over the two days of data collection. The non- 
normal scenarios were grouped into three categories (A, B, and 
C), with two non-normal runs in each category. Category A 
featured failures, initially unannunciated, with autopilot still 
available following the failure; Category B featured 
annunciated failures with the autopilot still available; and, 
Category C featured annunciated failures with autopilot not 
being available after the failure. Alert type and autopilot state 
were used to identify workload and automation issues (i.e., by 
availability of autopilot) and flight crew awareness and 
monitoring for normal / non-normal operations (i.e., alerting). 
All flights were flown to landing. 


Failures were triggered near top of climb or top of descent. 
This paper details one Category B failure - a generator drive 
shaft failure. Etherington et al [5] provides a detailed 
description of the experiment design (factors, metrics, and run 
matrix) and details one Category C failure. The Auxiliary 
Power Unit (APU) was inoperative to increase workload for all 
scenarios and the APU was listed as INOP in the flight release 
and appropriately tagged in the flight deck. 


The data shown here is taken from 18 nominal Two-Crew 
runs and 18 drive shaft failure non-normal runs (6 SPO, 6 
RCO, 6 Two-Crew). For the RCO configuration, the non- 
normal started out with First Officer flying from the right seat 
and the Captain resting in the left seat, isolated in sight and 
sound from the cockpit. Two minutes after the flying pilot was 
alerted to the drive shaft failure, the resting pilot returned to 
flying duties in the cockpit. For the SPO configuration, each 
pilot flew from the left seat. 
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B. Participants 


Thirty-six pilots (18 crews total), representing 5 airlines, 
participated in this experiment. Each pilot held an Airline 
Transport Pilot rating and was current in the 737-800 aircraft 
as either Captain or First Officer. All participants were male. 
Crews were paired by function (Captain or First Officer) and 
employer to minimize conflicts in training, standard operating 
procedures, and crew resource management techniques. Crews 
were instructed to bring their company’s paper and/or 
electronic charts and 737-800 checklists with them to further 
reduce conflicts in training and standard operating procedures. 


C. Simulator 


The research was conducted using the B-737-800 simulator 
operated by the FAA AFS-440 at Oklahoma City, OK. The 
simulator is Level D-certified and can be used for both initial 
and recurrent training. The simulator, although a Level D 
training device, is also fitted with experimental controls, 
modifications, and recording capability to support AFS-440’s 
research mission. The fidelity of the simulator and the 
recording capability were both critical to this research effort. 


The test was set up to replicate a normal airline operation in 
today’s National Airspace System. An air carrier flight from 
Denver (KDEN) to Albuquerque (KABQ) was simulated. 
Dispatch paperwork for the flight was provided to the crews 
and constituted the flight release. 


The simulated weather en-route contained significant areas 
of convective activity along the Rocky Mountain front range 
and strong Northerly winds that required a north departure out 
of KDEN before a circuitous route to the west and then south 
to KABQ. This same planned route of flight was used for the 
entire two days of data collection. Weather and visibility were 
designed to affect any diversion decisions [5]. 


A live controller and pseudo-pilot(s) were tied into the 
simulation radio in real-time to simulate Air Traffic Control 
(ATC) and some proximate traffic to promote realism and 
maintain realistic pilot workload levels. A confederate also 
served as dispatcher in the Airline Operations Center and 
provided communications as necessary and appropriate when 
contacted. 


D. Training 


No additional training was conducted for the crews as they 
were qualified and current B737-800 pilots and the simulator 
was Level D-certified. 


The crews were briefed on the purpose of the experiment 
and received the dispatch paperwork. The crews were 
instructed to use their company’s standard operating 
procedures and checklists for the entire test, including any 
company dispatch calls and cabin crew communications as 
they would on any revenue flight. 


Prior to boarding the aircraft, the crew reviewed the 
paperwork and discussed the flight plan and flight conduct. 
Once they boarded the aircraft, the crew did a familiarization 
check and reviewed the simulator safety briefing. Known 
simulator-isms and aircraft differences were identified and 
discussed with the crew prior to run initiation. 


The aircraft initial condition for the nominal run was in the 
hold-short of Runway 35L at KDEN with the engines running, 
parking brake set and aircraft configured for takeoff. The Flight 
Management System (FMS) was pre-loaded with the planned 
flight routing and the crews were asked to double check the 
entries. After review and confirmation of the cockpit 
switches/set-up and completion of their normal checklists, the 
crew called KDEN tower for departure. 


Following clearance from ATC, the crew flew an entire 
nominal flight from KDEN to KABQ following the planned 
route of flight. The nominal flight served as a baseline for 
‘normal’ airline two-crew operations (i.e., nominal data) to 
which the non-normal runs flown in the RCO and SPO 
configurations would be compared. The nominal flight also 
promoted familiarity for the two-person crew interaction 
during the approximately 1.3 hours of flight time required for 
completion. This nominal flight was always flown as the first 
run on Day | of data collection for each crew. 


II. RESULTS 


The results shown here describe the major findings of only 
one of the Category B failure conditions, a Generator Drive 
Shaft failure. 


The Boeing 737 is a low-wing passenger aircraft powered 
by two CFM56-3C1 turbofan engines. Its electrical power 
system is made up of three main systems: the alternating 
current (AC) power system, the direct current (DC) power 
system, and the standby power system. Primary electrical 
power is supplied by two engine integrated drive generators 
(IDGs) supplying three-phase 115 volt, 400 Hz cycle AC. Each 
IDG normally supplies its own bus system but it can also 
supply power to the transfer bus of the opposite side 
automatically via the Bus Transfer Relay if one IDG fails. The 
APU drives a generator that can supply power to one Main AC 
Bus and both Transfer Buses in flight. (The APU was 
inoperative in this test however.) The DC system consists of 
three major buses: DC Bus 1, DC Bus 2, and the Battery Bus. 
DC Bus 1 and DC Bus 2 are powered directly by two 
Transformer Rectifier (TR) units that operate in parallel, each 
receiving AC inputs power from its respective 115V AC 
Transfer Bus. These two buses are backed up by a third, 
identical TR (TR-3) through an isolation diode. In addition to 
its back up function, TR-3 is the primary source of power for 
the Battery Bus. As long as power is available to TR-3, it will 
power the Battery Bus. If power is lost to TR-3, the Battery 
Bus will automatically transfer to receive power from the Hot 
Battery Bus. The aircraft is air-conditioned and pressurized 
using ambient external air and hot air generated from the 
engine compressors. The system operates automatically to 
maintain the settings and demands required of it using electro- 
mechanical devices. 


Electrical failures are complex and difficult to understand. 
There are cascading failures where multiple systems fail in 
parallel or in sequence. They can even seem random at times, 
so pilots either don’t make the connection to the electric 
system or they don’t connect all the failures lights to the single 
electrical system. In addition, load shedding, where smart 
systems manage the overall electrical load, adds to the 


complexity and difficulty diagnosing the electrical failure. 
Load shedding is not communicated to the pilot, is not 
typically taught in systems training because of complexity, and 
operates differently each time because it is dynamic and 
depends on actual electrical loads. One example of a system 
that is affected intermittently with load shedding is the 
pressurization system. 


Pressurization is maintained by controlling an outflow 
valve while the air conditioning system supplies positive 
pressure air. With the valve open, the airplane will not 
pressurize. With the valve closed, the cabin pressure will start 
to rise. The valve is normally automatically opened and closed 
to maintain a scheduled cabin pressure. To maintain 
pressurization, at least one pack - air cycle machines that are 
driven by engine bleed air - must remain on. The packs depend 
on electrical power for operation. If both packs trip off, even 
with the outflow valve closed, the cabin will slowly lose 
pressure. The valves are electrically controlled and 
pneumatically operated. 


With electrical problems, the packs will trip at random 
times due to fan cooling being intermittently load shed. If the 
pack cannot maintain the selected temperature, the pack will 
trip off. To keep the pressurization working, continuous 
monitoring and resetting of the packs during electrical failures 
may be necessary. The AUTO FAIL light may come on as 
well. The procedure for resetting a pack comes from the PACK 
light. If the pilot follows the AUTO FAIL light procedure, it 
does not direct them to reset the pack but only to eventually get 
the pressurization panel into manual mode and close the 
outflow valve. This does not restore pressurization (the outflow 
valve is already closed) and cabin altitude will increase above 
acceptable limits. The cabin depressurization warning horn will 
sound when the cabin exceeds 10,000 ft. 


The generator drive shaft failure was modeled as a left-side 
shaft shear with the right-side unable to pick up the electrical 
load. The APU was inoperative. The drive shaft failure was 
initially annunciated to the flight crew through illumination of 
the: a) DRIVE light on the overhead standby power panel and 
TRANSFER BUS OFF and SOURCE OFF lights on the 
overhead bus transfer panel; and, b) left and right side 
MASTER CAUTION lights and HYD and OVERHEAD 
system annunciator lights on the glare shield annunciation 
panel. Additionally, if the A-side autopilot was engaged, it 
automatically disconnected and the autopilot disconnect horn 
sounded. The B-side autopilot was still available after the 
failure. Loss of AC Bus | caused the yaw damper, probe heat, 
and left hand side pack to switch off; multiple overhead lights 
to illuminate such as the LOW PRESSURE lights on electrical 
1 and on the fuel pumps. As the flight progressed, the dynamic 
load shedding of the remaining AC Bus affected other systems 
such as the right pack. 


A. Failure Handling and Flight Path Control 


The drive shaft failure occurred at waypoint DATME 
approximately 15 minutes prior to the top of descent during the 
cruise phase of flight at 36,000 ft mean sea level (MSL) while 
heading south toward KABQ. 


Once the failure occurred, 15 out of 18 pilots/crews 
declared an emergency with ATC. All SPO pilots declared an 
emergency. The three crews (2 RCO, | Two-Crew) who did 
not contact ATC and declare an emergency did not discuss 
with each other if they should declare an emergency or not. 
The pilots in the Two-Crew configuration did contact ATC and 
let them know they had an electrical failure and requested the 
KABQ Runway (Rwy) 08 ILS approach instead of the RNAV 
(RNP) RWY 08 approach. 


The flight was planned for the RNAV arrival to KABQ 
Runway 8. Following the failures, RNAV approach procedures 
are not authorized since two sources of AC power are required 
for this operation. Eleven crews requested vectors from ATC 
for the KABQ Rwy 08 ILS approach. The remaining crews (2 
Two-Crew, 3 RCO, 2 SPO) flew the RNAV arrival as planned. 
Crew complement does not appear to have influenced the 
decision to continue flying the RNAV approach after the drive 
shaft failure event as there was nearly an equal distribution 
between the three configurations for these crews. 


Seven of the 18 pilots/crews experienced a cabin 
depressurization event while completing the approach with the 
drive shaft failure as they didn’t continuously monitor and reset 
the packs tripped off by load shedding. Interestingly, only 2 
crews (1 Two-Crew, | RCO) of the 7 donned oxygen masks 
during this depressurization event even though it is required 
pilot equipment above 10,000 ft MSL. 50% of the SPO runs 
had a depressurization event and none of the single pilots 
donned an oxygen mask. The initial altitude at which the 
depressurization warning sounded and the duration time to 
descend to 10,000 ft by the 5 crews (1 Two-Crew, 1 RCO, and 
3 SPO) who did not don oxygen masks ranged from 10,800 ft 
MSL/29 seconds to 15,420 ft MSL/219 seconds. 


B. Checklist Usage 


Time-to-first correct checklist was used as a metric for 
quick and proper troubleshooting of equipment problems. 


For the Drive Shaft failure, it was an alerted failure with 
annunciation on the flight deck that had a direct entry in the 
Quick Reference Handbook (QRH) with the DRIVE checklist. 
Two other indications, TRANSFER BUS OFF and SOURCE 
OFF, with direct entries in the QRH, were also annunciated on 
the flight deck. After assessing the myriad of lights illuminated 
on the overhead panel due to left drive shaft failure and 
subsequent power shedding, the critical checklist pilots should 
have executed was the DRIVE checklist which disconnects the 
drive from the motor to prevent further damage to the 
generator and potentially an engine fire. 


Table 1 reveals that 50% of the pilots in the Two-Crew 
configuration properly identified the failure and chose the 
DRIVE checklist as their first one to execute, while only 17% 
of the pilots in either the RCO or SPO configurations initially 
chose the correct DRIVE checklist. One SPO pilot found that 
maintaining flightpath control, communicating with ATC, and 
dealing with the electrical failures was so demanding that he 
did not run any checklists. Five crews ran more checklists than 
the initial one as they troubleshot the electrical failures. Taking 
that into consideration, 67% of the Two-Crew, 33% of the 
RCO, and 33% of the SPO crew configurations ran the correct 


DRIVE checklist prior to landing. The remaining pilots/crews 
used only the SOURCE OFF checklist and/or TRANSFER 
BUS OFF checklist to attend to the drive shaft failure (Table 
1). 


Crew complement was statistically — significant 
(F(2,14)=3.78, p=0.049) for time-to-start initial electrical 
checklist, but not operationally relevant. On average, the Two- 
Crew and SPO crews took approximately 100 seconds to start 
the first electrical checklist and RCO crews took approximately 
241 seconds. All but one of the RCO crews delayed checklist 
usage until the resting pilot was re-engaged. Accounting for the 
two minute fixed delay for the RCO crews, the time to start the 
initial checklist was around 20 seconds later for the RCO 
compared to the Two-Crew and SPO crews. This delay is 
incurred due to the flying pilot who briefed the returning pilot 
on the current situation of their aircraft upon his return from 
crew rest. 


TABLE I. ELECTRIAL CHECKLISTS ACCOMPLISHD BY CREW TYPE 
ies é Electrical-Related 
Crew inal Rpecklist Checklists Completed 
Checklist Start Total Drive Source Transfer 
Name (sec) (sec) Off Bus Off 
RCO Source Off 98 24 xX 
Transfer 
RCO Bus Off 235 69 x 
RCO Source Off 122 36 xX 
RCO Drive 224 36 x 
Transfer 
RCO Bus Off 253 29 x x 
Transfer 
RCO Bus Off 516 27 x 
SPO |: ------------ -- -- 
SPO Source Off 131 82 x 
SPO Source Off 46 30 x Xx Xx 
SPO Drive 98 32 x 
SPO Source Off 64 28 x 
SPO Source Off 162 84 x 
Two Source Off 226 28 Xx 
Two Drive 67 45 x x 
Two Drive 120 41 x 
Transfer 
Two Bus Off 77 48 x x 
Two Drive 41 31 x 
Transfer 
Two Bus Off 79 65 x x 


Time-to-complete the initial checklist was considered 
another indicator for safely handling failures. Crew 
complement was not significant (F(2,14)=0.70, p=0.513) for 
time-to-complete the initial electrical checklist. The overall 
mean time for the crews to complete the checklist was 44 
seconds. The three checklists for this electrical failure were 
short and straightforward since the APU was inoperative. All 
ended with the instruction ‘plan to land at the nearest suitable 
airport’ and with the note ‘only one main AC power source 
remains’. 


No checklist items in the DRIVE, TRANSFER BUS Off, 
or SOURCE OFF checklists were missed as the pilots initially 
handled the drive shaft failure. However, as load shedding 


occurred, 7 of the 18 pilot/crews experienced a cabin 
depressurization event by not properly managing the pack 
systems. 


C. Diversion Decision 


The test was staged to evaluate decision-making by the 
flight crew. A diversion decision after a failure was part of this 
decision-making test which tasked the pilots to consider 
distance to fly with the failure, the weather at each airport 
(KABQ and possible divert airports), and the time it took to 
troubleshoot the problem. Another factor that played 
specifically in the pilot’s decision-making process for a left 
drive shaft failure was that they had only one source of AC 
power remaining since the APU was inoperative. 


The reality is that when the drive shaft failure happened 
within 15 minutes to the top of descent, the best option was to 
continue a landing to the destination at KABQ. For the drive 
shaft failure, all crews, regardless of crew configuration, 
continued to the destination and landed safely. Santa Fe was 
the alternate airport for the flight but even though it was in the 
direct flight path, it had the same weather as Albuquerque 
(1000 foot ceiling and 3 miles visibility), a shorter runway, and 
would require a steeper descent rate or ATC vectoring on a 
flight path that would be the same distance as going to the 
destination. Since Albuquerque, the destination airport, was 
only an additional 60 miles with better support facilities and 
the Flight Management System was already configured for 
flight to KABQ, Santa Fe was not considered a_ better 
alternative by any crews for the drive shaft failure runs. 


D. Workload 


The NASA Task Load Index (TLX) captured a subjective 
rating (0 [Low] to 100 [High]) of perceived task load. There 
are six subscales of workload represented in the NASA TLX: 
mental demand, physical demand, temporal demand, 
performance, effort, and frustration level [6]. The overall score 
results of this measure were examined to investigate task load 
variation. 


Not surprisingly, independent analyses revealed significant 
differences between the nominal and drive shaft failure runs for 
both pilot-flying (PF) (F(1,34)=5.98, p=0.02) and _pilot- 
monitoring (PM) (F(1,28)=6.46, p=0.017) TLX ratings (Fig. 
1). [The boxplots show the median ratings, with the 25" and 
75" percentile spread in the data; the maximum and minimum 
values; and mean ratings (connected by a line).] For the drive 
shaft failure runs, pilots rated their overall workload as being 
moderate, as reflected in the PF (mean rating=52) and PM 
(mean rating=51) TLX ratings. 


There were no significant (p>0.05) crew complement 
differences for PF overall TLX ratings or PF subscale TLX 
ratings during a drive shaft failure run. Single pilot operations 
were rated as having moderately high workload (mean=67) 
while crewed operations were rated as having moderate 
workload (Fig. 2). 
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Fig. 1. Overall TLX pilot-flying and pilot-monitoring ratings for drive shaft 
failure and nominal runs 
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Fig. 2. Overall TLX ratings for pilot-flying drive shaft failure runs by crew 
configuration 


Workload 


Although the differences are not statistically significant, the 
physical workload TLX rating data highlights the significant 
change in the physical demands placed on the pilot-flying 
during Two-Crew and RCO conditions to SPO operations (Fig. 
3). 
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Fig. 3. Physical TLX ratings for pilot-flying drive shaft failure runs by crew 
configuration 


E. Safety of Flight 

Perceived level of safety was self-assessed using a Likert 
type scale from 1-7, where | was completely acceptable and 7 
was completely unacceptable. 


An ANOVA _ revealed significant differences 
(F(.,34)=15.57, p<0.001) between the nominal runs 
(median=1) and drive shaft failure runs (median=2.5) for PF 
Perceived Safety of Flight ratings. Fig. 4 illustrates these 
differences, where from an overall perceived level of safety for 
the PF compared to normal flight, this failure was difficult for 
some pilots as indicated by the large spread in data. 
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Fig. 4. Perceived safety of flight ratings for pilot-flying drive shaft failure 
and nominal runs collapsed across crew configuration 


An ANOVA showed significant crew complement 
differences (F(2, 15)=3.75, p=0.048) for PF perceived safety of 
flight ratings. Fig. 5 shows the PF rating for each crew 
complement configuration. Pilots viewed the safety of this 
failure as unacceptable during single pilot operations (median 
rating=4.5) where the pilot had to simultaneously maintain 
flightpath control, communicate with ATC/Dispatch, and 
perform checklists. PF ratings indicated safety of flight was 
acceptable for this failure in the Two-Crew configuration. 


Safety Rating 
Baz 


w 


Two RCO ‘SPO 


Fig. 5. Perceived safety of flight ratings for pilot-flying drive shaft failure 
runs by crew configuration 


IV. DISCUSSION 


This paper highlights the data and analysis for one non- 
normal scenario out of six evaluated, a generator drive shaft 
failure, and it supports the conclusion that anything less than 
two crew members will require significant redesign of 
automation and increased levels of automation support. Safety 
of flight was compromised when a single pilot had to 
troubleshoot and attend to the electrical failure with dynamic 


load shedding while simultaneously maintaining flightpath 
control and communicating with air traffic control. Workload 
increased to moderately high levels during single pilot 
operations. The effects of reduced crew (i.e., the RCO 
condition) was evident but not as severe as SPO. 


When the drive shaft failure occurred, overhead and master 
caution lights indicated electrical problems on the left side 
system, the autopilot disconnected, and load shedding to 
manage the airplane’s electric loads began. Troubleshooting 
and correctly determining the cause of the electrical problem 
was two times better in the two-crew configuration than in the 
reduced crew or single pilot configurations. However, even in 
the two-crew configuration, one-third of the pilots did not 
accurately identify that a drive shaft failure was responsible for 
the degraded electrical system and its associated non-normal 
checklist was the critical one to execute. The current-day 
caution and warning system clearly identifies a fault but does 
not articulate or annunciate the root cause nor the systems and 
capabilities that are impacted, degraded, or inoperative. 


Approximately 39% of the crews had a_ cabin 
decompression event during the descent phase of flight as they 
did not adequately attend to intermittent pack trips caused by 
dynamic load shedding. Part of this may be a simulation 
artifact. Some pilots indicated that in the actual airplane they 
would have felt the pressurization problem developing (ears 
popping) and would have actively managed the issue. Some 
pilots were reluctant to resetting the packs more than one time. 
New 737-800 cockpit applications, such as interactive, 
electrical and air system synoptic pages and electronic 
checklists, could be developed to aid the flight crew in 
identifying critical items that had failed and automatically 
provide them the associated checklists (prioritized from most 
critical to least) to attend to the failures. 


Not all crews appropriately donned their oxygen masks 
when the pressurization horn sounded. In some cases, it was 
workload shedding by the pilots and they felt that they couldn’t 
turn their attention from the immediate problem to don the 
mask. In others, it was a combination of workload shedding 
and situation awareness; several times, the crews were already 
descending and nearing 10,000 ft MSL. Putting on the mask 
took valuable time to reset their radios and intercom so they 
could communicate. In debrief commentary, the pilots felt that 
they would be at or below acceptable altitudes soon enough 
that hypoxia would not be a concern and masks were of lesser 
importance than other duties and tasks. Note that descent to 
10,000 ft MSL was not always practical since the minimum 
safe altitude reaches as high as 14,800 ft MSL on the RNAV 
arrival into KABQ. 


This failure occurred about 15 minutes prior to top-of- 
descent; diversion to an alternate airport was not a proper 
course of action. However, once the failure occurs, even 
though the RNAV arrival was loaded in the FMS, the aircraft 
was degraded and the RNAV arrival was not an approved 
operation. Some airlines have specific call-outs in their QRH 
which identify equipage requirements for certain operational 
capabilities. These data are not, however, automatically 
provided. The crew is aware from the caution and alerting 
system that AC power is degraded, but not that RNAV arrivals 


are not approved in this condition. They must actively seek out 
and search for the information while simultaneously working 
the systems, flying and navigating the aircraft, while 
communicating to ATC and airline dispatch. In many cases, the 
pilots did not know that RNAV arrivals were not an approved 
operation and that did not matter. They exercised their good 
judgement and requested ATC assistance by asking for vectors 
and a long ILS approach procedure. When in high workload 
conditions, especially in an SPO configuration, assistance 
wherever and whenever possible was a good thing, and the less 
demanding tasks, the better. 


For this failure, the workload and performance decrements 
as crew complement changed may have been optimistic 
because the failure occurred so near to top of descent. At this 
point, the aircraft is approaching the planned destination and 
the route of flight is basically loaded into the FMS. The flight 
duration was not excessive. 


Although the perceived safety of flight data shows that 
RCO or SPO operations are not desirable, all crews/pilots were 
able to safety conduct and complete a safe landing. For the 
SPO case, some task shedding and some errors and procedural 
omissions were noted although errors and procedural omissions 
were also noted during Two-Crew and RCO conditions. The 
TLX physical demand data is indicative of how the change in 
the crew complement significantly impacts the number of 
switch actions, button presses, control inputs, and other 
ancillary duties which are now the burden of a single pilot, 
thus, significantly increasing the risk of errors on the flight 
deck. 


V. CONCLUDING REMARKS 


This paper highlights the effect of changing the human pilot 
contribution - by crew complement changes to RCO or SPO — 
to the level of the safety and performance in today’s airspace 
with today’s cockpit design. The data indicate the adaptability 
of pilots/flight crew to overcome non-normal conditions and 
complete safe recoveries. The data also indicate that single 
pilot operations are not acceptable due to the significant task 
demands and workload to handle the drive shaft generator 
failure. 


Data analysis of the nominal runs and six failure runs is 
being used to establish quantitative baseline levels of 
performance and flight safety during nominal two-crew 
operations. These nominal data are being used to assess 
performance and safety decrement in reduced crew or single 
pilot operations using current-day flight deck design and 


certification. The nominal data are also being employed to 
identify and develop new applications and _ technology 
requirements for increasingly autonomous systems to assist 
pilots during dynamic and unplanned situations and perhaps 
future operations with two-crew, reduced crew, or possibly 
commercial single pilot operations. 
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